category: Endpoint
sectionorder:
- Connect
- Collect
provider: Zscaler
commonfields:
  id: ZeroTrustAnalyticsPlatform
  version: -1
configuration:
- defaultvalue: https://portalapi.threatanalytics.io/
  display: ZTAP server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: API Key
  additionalinfo: The API Key to use for connection
  name: apikey
  required: true
  type: 4
  section: Connect
- display: Reopen Group
  additionalinfo: Group to send to when reopening
  defaultvalue: Default
  name: reopen_group
  required: true
  type: 0
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Incident Mirroring Direction
  defaultvalue: Both
  name: mirror_direction
  options:
  - None
  - Incoming
  - Outgoing
  - Both
  type: 15
  hidden:
  - marketplacev2
  - platform
  required: false
  section: Collect
- display: Comment entry tag
  additionalinfo: Adding this tag to a Note will sync as a comment in ZTAP
  defaultvalue: comment
  name: comment_tag
  type: 0
  required: false
  section: Collect
- display: Escalate entry tag
  additionalinfo: Adding this tag to a Note will reassign the alert back to Critical Start SOC
  defaultvalue: escalate
  name: escalate_tag
  type: 0
  required: false
  section: Collect
- display: ZTAP input tag
  defaultvalue: ztap
  name: input_tag
  type: 0
  required: false
  section: Collect
- display: Fetch attachments for comments from ZTAP
  defaultvalue: 'false'
  name: get_attachments
  type: 8
  required: false
  section: Collect
- display: Sync closing incidents with ZTAP
  defaultvalue: 'false'
  name: close_incident
  type: 8
  required: false
  additionalinfo: Cortex XSOAR only parameter.
  hidden:
  - marketplacev2
  - platform
  section: Collect
- display: Sync reopening incidents with ZTAP
  defaultvalue: 'false'
  name: reopen_incident
  type: 8
  required: false
  section: Collect
- display: First fetch timestamp
  defaultvalue: 3 days
  name: first_fetch
  type: 0
  required: false
  section: Collect
- display: Maximum number of incidents to fetch
  defaultvalue: '100'
  name: max_fetch
  type: 0
  required: false
  section: Collect
description: Zero Trust Analytics Platform (ZTAP) is the underlying investigation platform and user interface for Critical Start's MDR service.
display: ZeroTrustAnalyticsPlatform
name: ZeroTrustAnalyticsPlatform
script:
  commands:
  - name: get-mapping-fields
    arguments: []
    description: Get mapping fields from remote incident.
  - name: get-remote-data
    arguments:
    - description: The remote incident id.
      name: id
      required: true
    - defaultValue: '0'
      description: UTC timestamp in seconds. The incident is only updated if it was modified after the last update time.
      name: lastUpdate
    description: Get remote data from a remote incident. This command should only be called manually for debugging purposes.
  - name: ztap-get-alert-entries
    arguments:
    - description: The remote incident id.
      name: id
      required: true
    description: Get the entries data from a remote incident.
  isfetch: true
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.0.0
defaultmapperin: ZeroTrustAnalyticsPlatform - Incoming Mapper
defaultmapperout: ZeroTrustAnalyticsPlatform - Outgoing Mapper
tests:
- No tests (auto formatted)